Our Privacy Policy in Full

This policy explains what personal data we collect when you play at Royallama Casino, why we hold it, who sees it and how long we keep it. It applies to every account holder and visitor of our website.

What Data We Collect

We only collect data we need to run your account, meet our licence conditions and keep you safe. The categories below cover everything we hold, and nothing beyond them.

• Identity data: full name, date of birth, email address, telephone number, residential address.
• Verification documents: photo ID, proof of address and payment method evidence for KYC checks.
• Transaction data: deposits, withdrawals, bonuses, wagering history and payment instrument details.
• Technical data: IP address, device identifiers, browser type and approximate location.
• Gameplay behaviour: games played, stakes, session times, win and loss records.
• Marketing preferences: which channels you opted into and how you responded.

Why We Use Your Data

We open your account, verify your identity and process every payment using the data you give us. Beyond account operation, we monitor play patterns for fraud prevention and responsible-gambling purposes, because our Malta licence requires it.

• Creating and managing your player account.
• Carrying out KYC and anti-money laundering checks.
• Processing deposits and withdrawals.
• Detecting fraud, bonus abuse and multi-accounting.
• Monitoring play against responsible-gambling markers.
• Sending marketing messages where you consented.
• Meeting legal and regulatory obligations.

Our Legal Bases

Contract: where processing is necessary to provide the service you signed up for, such as account management, game play and payments.

Legal obligation: we process identity and transaction data because gambling law and AML rules oblige us to verify players and report suspicious activity.

Legitimate interest: fraud prevention, site security and aggregated service improvement rely on this basis, balanced against your rights.

Consent: marketing emails, SMS and personalised offers run only on your explicit opt-in, which you may withdraw at any time.

How Long We Keep It

Nothing is stored forever. Each category has a defined clock, and deletion runs automatically once the period expires unless an ongoing investigation requires us to hold records longer.

Who We Share It With

We never sell your data. Sharing is limited to partners who help us operate, and each one works under a written data processing agreement.

• Payment processors handling your deposits and withdrawals.
• KYC and AML verification providers checking your documents.
• The Malta Gaming Authority and other regulators we answer to.
• Analytics and hosting providers under strict access limits.
• Professional advisers such as auditors, lawyers and tax specialists, where relevant.

Know Your GDPR Rights

You control your data, and every request below costs nothing. We answer within one month, extendable by two months only for complex cases, and we tell you if we do.

• Access: get a copy of the data we hold about you.
• Rectification: correct anything inaccurate or incomplete.
• Erasure: ask us to delete data we no longer need.
• Portability: receive your data in a machine readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: stop marketing at any time via account settings or the unsubscribe link.
• Complain: contact the Information Commissioner's Office or your national data protection authority.

Cookies and Tracking

We use essential cookies to keep you logged in and secure, plus optional analytics and marketing cookies that load only after you accept them in the cookie banner. Full details, including how to change your choices, sit on our separate Cookies Policy page.

How We Protect Your Data

All traffic to and from our servers is encrypted with TLS, and stored verification documents sit encrypted at rest with access limited to trained staff on a need-to-know basis. We test our controls regularly and log every internal access to your records.

If a breach happens

We notify the competent supervisory authority within 72 hours of becoming aware of a qualifying breach, and we tell you directly without undue delay where the breach poses a high risk to your rights.

Contact Our Data Team

Questions about this policy or your data go to [email protected], and rights requests to [email protected]. Our support team is also available on live chat 24/7. Since 2026, players from EU locales fall under GDPR in full, and we honour it for everyone regardless of location.

Frequently asked questions

Do you keep my ID documents forever?

No. Verification documents are deleted 5 years after your account closes, in line with our MGA licence obligations.

Can I stop marketing emails?

Yes. Withdraw consent at any time through your account settings or the unsubscribe link in any message; marketing data is then deleted.

How do I get a copy of my data?

Email [email protected] with your request and we send a machine readable copy within one month, free of charge.